Case 1 :06-mj-00073-AK Document 1-2 Filed 02/23/2006 Page 1 of 26 



UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 

AFFIDAVIT IN SUPPORT OF SEARCH WARRANT 



IN THE MATTER OF THE SEARCH 
OF E-MAIL ACCOUNTS: 

paradisepassion@email.com 
offerparadise@yours.com 

located at Mail.com Corporation 
4957 Lakemont Boulevard 
Bellevue, Washington 98006 



I, Matthew Dunn, being duly sworn, depose and state the following: 

1. I am a Senior Special Agent (SS/A) with U.S. Immigration and Customs 
Enforcement (ICE). I have been an agent for seven and one half years. I am currently assigned 
to the Child Exploitation Section of the Cyber Crimes Center (CES/C3) where I am responsible 
for conducting federal and international investigations relating to crimes involving the sexual 
exploitation of children. I am a graduate of the Federal Law Enforcement Training Center's 
Criminal Investigator Training Program and have received basic, advanced, and on-the-job 
training in the investigation of cases involving the sexual exploitation of children. I have also 
trained other law enforcement officers in investigating computer facilitated crimes against 
children. 

2. I am submitting this affidavit in support of an Application for a Search Warrant 
authorizing a search of Mail.com Corporation, an e-mail service provider, at 4957 Lakemont 
Boulevard, Bellevue, Washington, described in Attachment A, incorporated herein by 
reference, which is located in the Western District of Washington. More specifically, I seek 
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authorization to search Mail.com Corporation's records, where items specified in Attachment 
B, incorporated herein by reference, may be found, and to seize all items listed in Attachment B 
as evidence, fruits, and instrumentalities of criminal activity. As set forth below, there is 
probable cause to believe that evidence, fruits, and instrumentalities of violations of 18 U.S.C. 
§§ 2423(a), 2423(b), 2423(c), 2423(d), and 2251(d)(1)(A) may be found in Mail.com 
Corporation's records. 

3. The factual information supplied in this affidavit is based on my investigation of 
this case, my experience and background as an ICE agent, and information provided by 
Detective Sergeant (DS) Andrea Seul of the German Federal Police (Bundeskriminalamt, 
"BKA") and Captain Jens Wrischke of the Hamburg State Police (Polizei Hamburg, "HPSD"). 
Since I am submitting this affidavit for the limited purpose of securing a search warrant, I have 
not set forth every fact of this investigation. 

STATUTORY AUTHORITY 

4. This investigation concerns alleged violations of 18 U.S.C.§§ 2423(a), 2423(b), 
2423(c), 2423(d), and 2251(d)(1)(A), relating to the sexual exploitation of minors. 

5. 18 U.S.C. § 2423(a) prohibits a person from knowingly transporting an individual 
who has not attained the age of 18 years in interstate or foreign commerce, or in any 
commonwealth, territory or possession of the United States, with intent that the individual 
engage in prostitution, or in any sexual activity for which any person can be charged with a 
criminal offense. 

6. 18 U.S.C. § 2423(b) prohibits a person from traveling in interstate commerce or 
traveling into the Unites States, or a United States citizen or an alien admitted for permanent 
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residence in the United States from traveling in foreign commerce, for the purpose of engaging 
in any illicit sexual conduct with another person. 

7. 18 U.S.C. § 2423(c) prohibits a United States citizen or alien admitted for 
permanent residence from traveling in foreign commerce and engaging in any illicit sexual 
conduct. 

8. 18 U.S.C. § 2423(d) prohibits a person, for the purpose of commercial 
advantage or private financial gain, from arranging, inducing, procuring, or facilitating the travel 
of another person knowing that such person is traveling in interstate commerce or foreign 
commerce for the purpose of engaging in illicit sexual conduct. 

9. 18 U.S.C. § 2251(d)(1)(A) prohibits a person from knowingly making, printing, 
or publishing, or causing to be made, printed, or published, any notice or advertisement seeking 
or offering to receive, exchange, buy, produce, display, distribute, or reproduce, any visual 
depiction, if the production of such visual depiction involves the use of a minor engaging in 
sexually explicit conduct and such visual depiction is of such conduct, if such person knows or 
has reason to know that such notice or advertisement will be transported in interstate or foreign 
commerce by any means including by computer or mailed. 

DEFINITIONS 

10. The following definitions apply to this Affidavit and Attachment B: 

1 1 . "Child Pornography" means any visual 

depiction of sexually explicit conduct where (a) the production of the visual depiction 
involved the use of a minor engaged in sexually explicit conduct, (b) the visual depiction 
is a digital image, computer image, or computer-generated image that is, or is 
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indistinguishable from, that of a minor engaged in sexually explicit conduct, or (c) the 
visual depiction has been created, adapted, or modified to appear that an identifiable 
minor is engaged in sexually explicit conduct. See 18 U.S.C. § 2256(8). 

12. "Visual depictions" include undeveloped film and videotape, and data stored on 
computer disk or by electronic means, which is capable of conversion into a visual image. See 
18 U.S.C. §2256(5). 

13. "Minor" means any person under the age of eighteen years. See 18 U.S.C. § 
2256(1). 

14. "Sexually explicit conduct" means actual or simulated (a) sexual intercourse, 
including genital-genital, oral-genital, or oral-anal, whether between persons of the same or 
opposite sex; (b) bestiality; (c) masturbation; (d) sadistic or masochistic abuse; or (e) lascivious 
exhibition of the genitals or pubic area of any persons. See 18 U.S.C. § 2256(2). 

15. "Computer" as used herein, is defined pursuant to 18 U.S.C. § 1030(e)(1), as "an 
electronic, magnetic, optical, electrochemical, or other high speed data processing device 
performing logical or storage functions, and includes any data storage facility or 
communications facility directly related to or operating in conjunction with such device." 

16. "Internet Service Providers" or "ISPs" are commercial organizations which 
provide individuals and businesses access to the Internet. ISPs provide a range of functions for 
their customers including access to the Internet, web hosting, e-mail, remote storage, and co- 
location of computers and other communications equipment. ISPs can offer various means by 
which to access the Internet including telephone based dial-up, broadband based access via a 
digital subscriber line (DSL) or cable television, dedicated circuits, or satellite based 
subscription. ISPs typically charge a fee based upon the type of connection and volume of data, 
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called bandwidth, that the connection supports. Many ISPs assign each subscriber an account 
name such as a user name or screen name, an e-mail address, and an e-mail mailbox and the 
subscriber typically creates a password for the account. By using a computer equipped with a 
telephone or cable modem, the subscriber can establish communication with an ISP over a 
telephone line or through a cable system, and can access the Internet by using his or her account 
name and password. 

17. "ISP Records" are records maintained by ISPs pertaining to their subscribers 
(regardless of whether those subscribers are individuals or entities). These records may include 
account application information, subscriber and billing information, account access information 
(often times in the form of log files), e-mail communications, information concerning content 
uploaded and/or stored on or via the ISP's servers, and other information, which may be stored 
both in computer data format and in written or printed record format. ISPs reserve and/or 
maintain computer disk storage space on their computer system for their subscribers' use. This 
service by ISPs allows for both temporary and long-term storage of electronic communications 
and many other types of electronic data and files. 

18. "Internet Protocol Address" or "IP Address" refers to a unique number used by a 
computer to access the Internet. IP addresses can be dynamic, meaning that the Internet Service 
Provider (ISP) assigns a different unique number to a computer every time it accesses the 
Internet. IP addresses might also be static, if an ISP assigns a user's computer a particular IP 
address which is used each time the computer accesses the Internet. 

19. "Domain Name" refers to the common, easy to remember names associated with 
an Internet Protocol address. For example, a domain name of "www.usdoj.gov" refers to the 
Internet Protocol address of 149.101.1.32. Domain names are typically strings of alphanumeric 

5 



Case 1 :06-mj-00073-AK Document 1 -2 Filed 02/23/2006 Page 6 of 26 

characters, with each level delimited by a period. Each level, read backwards - from right to left 
- further identifies parts of an organization. Examples of first level, or top-level domains are 
typically .com for commercial organizations, .gov for the governmental organizations, .org for 
organizations, and, .edu for educational organizations. Second level names will further identify 
the organization, for example usdoj.gov further identifies the United States governmental agency 
to be the Department of Justice. Additional levels may exist as needed until each machine is 
uniquely identifiable. For example, www.usdoj.gov identifies the world wide web server located 
at the United States Department of Justice, which is part of the United States government. 

20. "Log Files" are records automatically produced by computer programs to 
document electronic events that occur on computers. Computer programs can record a wide 
range of events including remote access, file transfers, logon/logoff times, and system errors. 
Logs are often named based on the types of information they contain. For example, web logs 
contain specific information about when a website was accessed by remote computers; access 
logs list specific information about when a computer was accessed from a remote location; and 
file transfer logs list detailed information concerning files that are remotely transferred. 

21. "Hyperlink" refers to an item on a web page which, when selected, transfers the 
user directly to another location in a hypertext document or to some other web page. 

22. "Website" consists of textual pages of information and associated graphic images. 
The textual information is stored in a specific format known as Hyper- Text Mark-up Language 
(HTML) and is transmitted from web servers to various web clients via Hyper- Text Transport 
Protocol (HTTP). 

23. "Uniform Resource Locator" or "Universal Resource Locator" or "URL" is the 
unique address for a file that is accessible on the Internet. For example, a common way to get to 
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a website is to enter the URL of the website's home page file in the Web browser's address line. 
Additionally, any file within that website can be specified with a URL. The URL contains the 
name of the protocol to be used to access the file resource, a domain name that identifies a 
specific computer on the Internet, and a pathname, a hierarchical description that specifies the 
location of a file in that computer. 

24. "Contents" as used with respect to any wire, oral, or electronic communication, 
includes any information, concerning the substance, purport, or meaning of that communication. 
See 18 U.S.C. §2510(8). 

25. "Electronic Communications System" means any wire, radio, electromagmentic, 
photo optical or photo electronic facility used for the transmission of wire of electronic 
communications, and any computer facilities or related electronic equipment for the electronic 
storage of such communications. See 18 U.S.C. § 2510(14). 

26. "Electronic Communication Service" means any service which provides to users 
thereof the ability to send or receive wire or electronic communications. See 18 U.S.C. § 
2510(15). 

27. "Remote Computing Service" means any service which provides to users thereof 
computer storage or processing services by means of an "electronic communications system." 
See 18 U.S.C. §2711(2). 

28. "Electronic Storage" means any temporary, intermediate storage of a wire or 
electronic communication incidental to the electronic transmission thereof, and any storage of 
such communication by an electronic communication service for purposes of backup protection 
of such communication. See 18 U.S.C. § 2510(17). Typically, e-mail that has not been opened 
by an ISP customer is stored temporarily by an ISP incident to the transmission of that e-mail to 
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the intended recipient, usually within an area known as the home directory. Such temporary, 
incidental storage constitutes "electronic storage." 



THE INVESTIGATION 

29. ICE/C3/CES is conducting a joint investigation with the German Federal Police 
("BKA") and the Hamburg State Police Department (Polizei Hamburg, "HSPD") into a 
commercial website offering sexual encounters with children. The website is located at URL: 
http://zelup.eom/l 1 1 and is known as "Paradise Passion." The investigation has revealed that 
this website offers individuals the opportunity to engage in sexual activity with minors. The site 
consists of five individual web pages, described in detail below. The site communicates with 
prospective customers via several e-mail accounts identified on the website. 

30. Two of the e-mail accounts identified on the website are 
paradisepassion@email.com and offerparadise @ yours .com , which are hosted by Mail.com 
Corporation, an ISP located in the United States. As discussed below, based on the investigation 
and my training and experience, there is probable cause to believe that evidence, fruits, and 
instrumentalities of the aforementioned crimes are located in Mail.com Corporation's records. 

A. The "Paradise Passion" Website 

31. On September 22, 2005, 1 was informed by Detective Sergeant (DS) Andrea Seul 
of the BKA that a commercial website known as "Paradise Passion" and located at URL: 
http://zelup.eom/l 1 1 was offering for sale sexual encounters with children. DS Seul had 
received this information from Captain Jens Wrischke of the HSPD. 
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32. On the same date, I accessed the website at URL: http://zelup.eom/l 11. The title 

bar of the listed URL read "Paradise Passion: Unique Children Sex Offer." The web page 

displayed an image of a nude female minor lying on her stomach next to the words "Paradise 

Passion." The image depicted a young girl between the age of nine and 13 years old, lying on her 

stomach with flowers covering part of her body. The young girl was resting on her elbows with 

her head tilted back and eyes closed. The following text appeared on this page: 

"Our private CP club is glad to present you a new, amazing and never seen before 
offer. Among our clients its called 'Paradise passion'. We want to offer you to 
have sex with a real child! Don't you tired of masturbating when viewing photos 
and low quality video content. Haven't you ever dreamt to have real sex with a 
cute underage girl or boy? Have you ever dreamt to kiss all over the young, 
innocent body of a child? There is no such pleasure in the whole world as to push 
your thing into pretty childish pussy or mouth. For our club its not just a dream - 
its sweet reality! Just stop imagine sex with a kid, you can make your dream come 
true with our help. 

Our service is absolutely safe and anonymous. So you shouldn't worry about this 
aspect. We've been delivering children all over the world to our members for 
almost 5 years and havent had any troubles. The system of delivering a kid is 
secured and anonymous because safety is the most important part for our clients 
and for us. So we spend lots of time and money to make everything safe for our 
clients. We have three kinds of our 'Paradise passion' offer. Here they are: 

1) We deliver a child to your country (We deliver children to almost every 
country except such contries as Iraq, Iran, Afghanistan etc) 

2) We deliver a child to a newtral country (we have a list of countries where 
having sex with a child is not a crime, so this is the safest way to meet and to have 
sex with out children) 

3) You come to a childs native country (All children are from Europe, so you 
won't have any problems to get there) 

More detailed information you can find out in 'HOW TO MEET' area. Also if 
you have more questions visit 'Frequently Asked Questions' area or just ask us 
using these email addresses. And remember that we can and will make your 
dreams come true. Let us open the gates of child sex paradise for you. 

Regards, 

Paradise passion team" 
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33. The site contained four hyperlinks, which directed me to four additional web 
pages. The hyperlinks were: "How to Meet;" "FAQ;" "Catalogue;" and "Contacts." 

34. The "How to Meet" hyperlink contained the following text:: 

"How to meet a kid for a sex. 

If you want to meet one of ours kids you should do some simple steps. Just 

follow them and your dream will come true 

First you should chose who do you want to meet. All information about the 

children who are available for a meeting, you will find here in the 

'CATALOGUE'. After you choose a girl/boy, choose a type of the meeting: 

1 TYPE We deliver a child to your country (We deliver children to almost every 
country except such countries as Iraq, Iran, Afghanistan etc) 

2 TYPE We deliver a child to a newtral country (we have a list of countries where 
to have a sex with a child is not a crime, so this is the safest type of our offer) 

3 TYPE You come to a childs native country (All children are from Europe, so 
you won't have any problems to get there) 

After that please write us a letter with the subject 'READY TO GO FURTHER'. 
In this letter you should mention the name of the child and type of the meeting. 
After that we will send you all further information about the meeting. 

ATTENTION: Please notice that our offer is not free. So that means that you will 
have to pay for the meeting and sex with the children. The sum depends on the 
type of the meeting. So after you send us a letter with the type of the meeting we 
will tell you the sum which you should pay for the meeting. 
So please, make your choise and and write us a letter. 

Regards, 

Paradise passion team" 

35. The "Catalogue" hyperlink contained images and descriptions of five 

prepubescent female minors and three prepubescent male minors. The girls were described as 

follows: 

"Dasha (also Daria) is 13 y.o. She lives in Poland with her mother and grand 
mother. Very interested in fashion and ancient literature. She is a brilliant girl. 
When in bed she is like a wild horse. She does all kinds of sex: anal,vaginal and 
oral. Knows English very well and it will be very interesting to have a 
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conversation with her." 

There were two images of Dasha displayed on the web page. The first image, 

Dashal.jpg, depicted Dasha standing on a sandy bank wearing a purple dress. The second 

image, Dasha2.jpg, depicted Dasha lying on the sandy bank, resting on one elbow, with her legs 

spread and her arm underneath her leg with her hand near her vagina. Dasha was nude in the 

second image. 

"Lada (also Ladienna) is 1 1 y.o. Lives is Poland , in the village with her mother 
and little brother. Very pleasant and kind girl. She is crazy about all animals and 
want to be a vet. She likes to travel and always happy when a member invites her 
to his country. She likes to have vaginal sex , but you also can do anal and oral 
sex without any troubles." 

There were two images of Lada displayed on the web page. The first image, Ladal.jpg, 

depicted Lada sitting on the edge of a wall with her legs hanging in a pool of water. Lada was 

wearing a red night gown, which was pulled up exposing her vagina. The second image, 

Lada2.jpg, depicted Lada standing in the pool of water lifting her night gown exposing her 

vagina and lower abdomen. 

"Laska is 10 y.o. and she is from Latvia. She is glamorous and gorgeous girl. She 
is crazy about jewellry and everything that sparks. Sometimes she can be naughty 
but if you make her a present she will do everything for you. Likes to dance , 
showing off in front of a mirror. Wants to be a fashion model. Will do everything 
in bed , especially likes when a man cums on her tummy." 

There were two images of Laska displayed on the web page. The first image, 

Laskal.jpg, depicted Laska standing in a doorway wearing a fur coat. The second image, 

Laska2.jpg, depicted Laska lying nude on a table, resting on one arm, with her legs spread 

exposing her vagina. 

"Molly is 6 y.o. We call her Little Sun ray . She is so sweet and innocent kid. You 
will forget about everything while spending time with Molly. If you will be kind 
to her she will be kissing you all the time you spend together. Likes ice-cream , 
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cats , dogs , dolls etc. Also likes to play with "live stick" as she calls a penis. We 
assure you that you won't forget time you spent with this little angel. But its 
forbidden to have anal sex with her, only vaginal and oral." 

There were two images of Molly displayed on the web page. The first image, 

Mollyl.jpg, depicted Molly sitting a purple sheet with her legs spread exposing her entire body. 

The second image, Molly2.jpg, depicted Molly bent over exposing her anus and vagina. 

"Soil is 8 y.o. She lives in Poland with her mother and 3 y.o. sister. We're sure 
that you will fell in love with her at the first sight. She's kind, brilliant, gentle , 
open-minded young lady. She is keen on music, like to sing, to draw, to do 
everything she is good at. She want to be a singer, that is why she usually sings 
songs while having sex. She has a very beautiful voice. She can do all in bed with 
her great pleasure." 

There were two images of Soil displayed on the web page. The first image, Solll.jpg, 
depicted Soil lying on her stomach on a cabinet, looking back at the camera with her feet in the 
air. The image depicted Soil wearing no clothes and talking on a telephone. Soil's vagina and 
anus were also exposed in the image. The second image, Soll2.jpg, depicted Soil lying on a 
cabinet with her head resting on her arm and one leg slightly bent, exposing her vagina. 

The boys were described as follows: 

"Ted is 5 y.o. and he lives in Berlin with his aunt. He is a naughty boy and he 
often fights with other children , but anyway he is a very nice and kind kid. He 
can play soccer and swim during the whole day and don't be tired. Also he is 
crazy about cars and his dream is to become a driver. Even though he is a naughty 
boy he is very obedient when having sex with a man. You can do oral and anal 
sex with Ted." 

There were two images of Ted displayed on the web page. The first image, Tedl.jpg, 

depicted Ted standing in a hot tub wearing a bathing suit. The second image, Ted2.jpg, depicted 

Ted sitting at a table wearing no clothes. 

"Mark is 6 and a half y.o. , he lives in Poland. Mark is an orphan and lives in 
orphanage. He is a very open-minded and clever boy. Likes to play basketball and 
wants to become a famous basketball player , like Michael Jordan. Also he likes 

12 



Case 1 :06-mj-00073-AK Document 1 -2 Filed 02/23/2006 Page 1 3 of 26 

to draw and we should say that he is very good at drawing. We're sure that you 
will have lots of fun with this boy. Anal and oral sex with this boy will be 
unforgettable." 

There were two images of Mark displayed on the web page. The first image, Markl.jpg, 

depicted Mark sitting at a small table outdoors. The second image, Mark2.jpg, depicted Mark 

nude holding a basketball over his head, exposing his penis. 

"Kirill is 7 y.o. and lives in Poland. He lives with his grandparents on the 
outskirts of Warsaw (the capital). He likes to travel around the world, he has 
already visited 8 foreign countries . He has been to the US 2 times and has had a 
trip around Europe. He likes when anyone takes pictures of him naked. When 
having sex he is obedient so you won't have any troubles with him. Also you can 
take some pictures of him for your private collection." 

There were two images of Kirill displayed on the web page. The first image, Kirilll.jpg, 

depicted Kirill standing in a lake or river, wearing no clothes, with his penis exposed. The 

second image, Kirill2.jpg, depicted Kirill sitting outside, wearing no clothes, with his penis 

exposed. 

36. The "Contacts" hyperlink provided the following e-mail addresses: 

"Support Team 

paradiseoffer@inbox.com 

paradisepassion@email.com 

Sales Manager 
offerparadise@yours.com " 

B. The German Investigation 

37. I am informed by Cpt. Wrischke that, during the period from on or about 
September 16, 2005 to on or about October 25, 2005, an HSPD undercover officer 
engaged in a series of e-mail communications with paradisepassion@email.com . These 
communications are detailed below: 
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38. On or about September 16, 2005, the HSPD officer ("HSPD") and 
paradisepassion@email.com ("PP") exchanged the following e-mails: 

HSPD: "I'm interested ich 'Soil' the 8 year old girl. I like to choose Type 1. 
How many children are available? You have also a different catalogue 
with more children to choose from? 

PP: You made a great choice. Soil is a real beauty. Now only those girls who 
are in the catalogue. Other children are busy with other members and will 
be busy until next summer. If you're ready to meet Soil, we should start 
to make all arrangements. So, please think over one more time and if 
you're really want to start. Let's do it. Please decide and write us back 
with your decision. 

HSPD: lets start with all the arrangements to meet Soil. What is the next step? 

PP: We're glad that you decided to start. Now we need some information. 
1. How should we call you? (name, nickname whatever). 

HSPD: Vincent is the name we'll use 

PP: 2. What type of meeting we should arrange? 

HSPD: We'll meet in a Restaurant. 

PP: 3. When do you want us to deliver a child? 

HSPD: I plan for October the 15 th . 

PP: 4. You be with the girl the whole week or less? 

HSPD: I will be with the girl the whole week. 

PP: 5. Will she live with you or should we rent a room for her? 

HSPD: She will live with me. 

PP: For this moment that is enough to start." 
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39. On or about September 19, 2005, the HSPD officer and 
paradisepassion@email.com exchanged the following e-mails: 



PP: "Hello Vincent We start making all the documents. Soil asked whether 

you going to make some entertainment for her. Maybe parks, cinema, zoo 
etc. 

HSPD: I wait for the documents. For sure I'll show Soil all kind of nice places in 
this big city. Cinema, Fun-Parks and the very big Zoo. I guess she will 
love it. How long will it take to arrange everything? 

PP: Hello, Vincent Documents will be ready in two weeks. Next step is to 

send us a prepay, I mean a part of the sum. We need the part of the sum to 
be sure that you're not from police and that you will come to meet a girl. 
Because we have an incident when we delivered a girl to Brazil and 
nobody was there. Since then the head of the club has made such a rule. 
Looking forward to your reply. 

HSPD: Now you ask for a prepay. If I make a prepay how can I be sure that I 

don't loose my money. Is there any security? On the other side I can pick 
up Soil for example in Poland and give you the money cash in the moment 
Soil is at the meeting point. You have your security and I have mine. 
Both side have to work very carefull and I think, this is the best solution. 
If the police would be behind you they would pay the money and then 
they chase you. I think my Offer is the best and gives the most security 
for everybody." 

40. On or about September 20, 2005, the HSPD officer and 

paradisepassion@email.com exchanged the following e-mails: 



PP: "I understand your concern but our club has rules. Also we don't take in 
cash because it unsecure. We have our security system which has been 
made during the years. And I have no rights to break it. To meet a person 
we always should know that the person really wants to meet a child. And 
prepay is a kind of proof. If everyone follow the rules everything will be 
safe and no one will be disappointed. 

HSPD: how much should I prepay and where should I send the money? Does it 
go to a Bank Account or does it go over Western Union? What kind of 
proof do I have that you're real and not a Fake? Nobody will sent you 
money in advance if he doesn't know you, or has some kind of proof that 
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you are serious people. There are a lot of Fakes in the Net who does offer 
a lot and there only interest is to take the money and run. Give me some 
kind of proof and then I'll pay. 

PP: Hello Vincent I thought that you already trust us. So, anyway we also at 
risk as you are. Because we will send you all information about bank 
account or western union address. I understand that you're hesitating but 
we also must be sure that you're not a fake and not from police. As I said 
in my last letter your prepay will be such proof. So, we have three ways 
of payment: 1. Wire Transfer 2. Western Union 3. E-Gold. And you 
should pay the third part of the sum in advance. Also you should know 
that if you will arrange another meeting in future the price for you will be 
reduced. Please make your choice and reply us." 

41 . On or about the same date, September 20, 2005, the HSPD officer e- 
mailed a response to paradisepassion@email.com in which the officer stated in substance 
that he would pay by either Western Union or wire transfer. 

42. On or about October 11, 2005, the HSPD officer e-mailed the following 
message to paradisepassion@email.com : "That sounds good to me. If it's Okay with 
you I like to meet Soil on the 1 st of November. Is it possible to get some new pictures of 
Soil (in clothes) so that I get a kind of feeling for her. I'll try to give Soil a pleasant time 
with visiting several nice places she will enjoy. By the way, why did you name me 
Hans? Is this some kind of misunderstanding? Well, what' s so ever. Now let' s plan our 
business. When will you send me over all the necessary documents? The $1,100, will 
come in few days. When will you like to get the rest of the money; at the time you bring 
Soil over to my place or after picking up Soil from my home?" 

43. On or about October 12, 2005, HSPD and paradisepassion@email.com 

exchanged the following e-mails: 

PP: "l sl of November it's ok. But please do not postpone the date anymore 
because on the 4" 1 of December she is going to other member. New pictures 
you'll get after prepay is made, I told you that there are rules of the club I can't 
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brake. You will see her picture on the documents of Soils we sent to you after the 
prepay. I thought that your name is Hans. Hm.. .Didn't you tell me that your name 
is Hans? Well, it doesn't matter, if you want you can tell me another name. The 
second part of the money we must get after you spend a week with Soil. There is 
also our rule. So everything is going ok, looking forward to hear from you soon. 

HSPD: The 1 st of November is definitv. I'll send over the money tomorrow or on 
Friday over Western Union. Could you tell me if the name and address you gave 
me is the right address to send the money? 

PP: Yes, the name and address is right, here it is: name: Kokarevs Jevgenijs 
city: Riga country: Latvija sum: $1 100 After you send money please send us this 
information: first and second of the sender city country MTCN (money transfer 
control number). If you don't want you may not send the second name of the 
sender, just the first name" 

44. On or about October 14, 2005, HSPD wired $ 1 100 to Kokarevs Jevgenij s 
in Riga, Latvia. Western Union records indicate that an individual by the same name, 
Kokarevs Jevgenijs, picked up the money on October 21, 2005. 

45. On or about October 14, 2005, HSPD and paradisepassion@email.com 

exchanged the following e-mails: 

HSPD: "the money transfer to you is done. It comes from: Vincent Kuttula 
Hamburg Germany MCTN: 369 802 3566. How would the procedure will go 
on? Will you send me any documents and where will we meet so that I take over 
Soil? By the way, should this business work out with no difficulties I'm also 
interested to make a deal also for the mid of December. Is this possible? 

PP: I will check whether the money are transferred or not on Monday when 
I'm from my business trip. 

46. On or about October 20, 2005, HSPD and paradisepassion@email.com 

exchanged the following e-mails: 

HSPD: "I didn't hear from you since last Friday. I send over the money you 
requested. Is something wrong with our deal? When will I hear from you and 
how will the arangement be settled with Soil bringing her to Hamburg? Please let 
me know soon so that I can take care about the preparing for the meeting. I told 
you about the interest to get another Kid in December over to Hamburg. Is it 
possible? 
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PP: Everything is going ok, I have just returned from my business trip and we 
will continue to work. We must decide where you and Soil meet each other. Do 
you want to meet her at the airport, train station or we should rent a room for her 
and you will come there. Please tell us what is more convenient for you. If you 
want to meet another kid in December, please tell which girl or ours do you want 
to meet and I will check if she is available on December." 



47. On or about October 22, 2005, HSPD sent the following e-mail message 
to paradisepassion@email.com : "I hope your business trip was successful. Now to our 
business. There are several places to meet us in Hamburg. It might be a good idea we'll 
meet us in a high frequented restaurant. There is one place where younger and older 
people like to go. The name of this restaurant is: 'Schweinske' in Lubecker Strasse 84 in 
Hamburg. I think a restaurant might be a good place for the first contact with Soil. Who 
will come over to bring Soil to Hamburg? How will we get in touch when you're in 
Hamburg? Is there somebody the while week in Hamburg so that I can get in touch with 
the person if something goes wrong? Well, I see forward seeing Soil on the 1 st of 
November and hope everything will work in our interest. For the December business I'll 
give you in few days detailed information." 

48. On October 25, 2005, paradisepassion@email.com responded to HSPD 
with the following e-mail: "Soil will be delivered by a young lady, her name is Lucy and 
she is 21 y.o. Right before the meeting we will give you tell toll free number of Lucy, so 
you'll be able to call her. Lucy will be in Hamburg for the whole week and you will be 
able to get in touch with her by phone." 

49. I am informed by DS Seul that the above October 25, 2005 e-mail was the 
last communication between the HSPD officer and paradisepassion@email.com . The 
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child was never delivered for the agreed upon meeting and paradisepassion @ email.com 
did not respond to any HSPD e-mails inquiring about why the child was not delivered. 

C. Analysis of the E-mail Accounts 

50. On or about October 21, 2005, 1 accessed a publicly available service 
located on the Internet to determine the registrant/owner of the domain names of the 
above identified e-mail addresses. This service is a free, commercial database service 
capable of identifying, among other things, the owner of a particular domain name. This 
database search indicated that the registrant/owner for domain names "email.com" and 
"yours.com" is Mail.com Corporation, 4957 Lakemont Boulevard, Bellevue, Washington 
98006. 

5 1 . Mail.com Corporation provides consumers with web-based e-mail 
services, which are accessible from any computer connected to the Internet, anywhere in 
the world. Mail.com Corporation allows individuals to personalize their e-mail address 
by offering numerous different domain names (i.e., johndoe@email.com and 
johndoe@yours.com). 

52. On October 21, 2005 and January 19, 2006, 1 issued a preservation request 
pursuant to 18 U.S.C. § 2703(f), requesting that Mail.com Corporation preserve the 
contents of the e-mail account paradisepassion @ email.com pending issuance of a search 
warrant. 

53. On November 16, 2005 and January 19, 2006, 1 issued a preservation 
request pursuant to 18 U.S.C. § 2703(f), requesting that Mail.com Corporation preserve 
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the contents of the e-mail account of ferparadi se@yours.com pending issuance of a search 
warrant. 

LEGAL AUTHORITY 

54. The legal authority for this search warrant application is derived from Title 18, 
United States Code, chapter 121, §§ 2701-11, entitled, "stored wire and electronic 
communications and transactional records access." 

55. Title 18 United States Code 2703(c)(A) allows for nationwide service of process 
of search warrants for the contents of electronic communications. Pursuant to 18 U.S.C. § 2703, 
as amended by the USA PATRIOT Act, Section 220, a government entity may require a 
provider of an electronic communication service or a remote computing service to disclose a 
record or other information pertaining to a subscriber or customer of such service pursuant to a 
warrant issued using procedures described in the Federal Rules of Criminal Procedure by a court 
with jurisdiction over the offense under investigation (emphasis added by your affiant). 

56. Title 18 U.S.C. § 2703 further states in part: 

(a) Contents of Wire or Electronic Communications in Electronic Storage. - A 
governmental entity may require the disclosure by a provider of electronic communication 
service of the contents of a wire or electronic communication, that is in electronic storage in an 
electronic system for one hundred and eighty days or less, only pursuant to a warrant issued 
using the procedures described in the Federal Rules of Criminal Procedure by a court with 
jurisdiction over the offense under investigation or equivalent State warrant. A governmental 
entity may require the disclosure by a provider of electronic communications services of the 
contents of a wire or electronic communication that has been in electronic storage in an 
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electronic communication system for more than one hundred and eighty days by the means 
available under subsection (b) of this section. 

(b) Contents of Wire or Electronic Communications in a Remote Computing Service. - 
(1) A governmental entity may require a provide of remote computing service to disclose the 
contents of any wire or electronic communication to which this paragraph is made applicable by 
paragraph (2) of this subsection - 

(A) without required notice to the subscriber or customer, if the governmental 
entity obtains a warrant issued using the procedures described in the Federal Rules of 
Criminal Procedure by a court with jurisdiction over the offense under investigation or 
equivalent State warrant; or 

(B) with prior notice from a governmental entity to the subscriber or customer if 
the governmental entity - 

(i) uses an administrative subpoena authorized by a Federal or State 
statute or a Federal or State grand jury or trial subpoena; or 

(ii) obtains a court order for such disclosure under subsection (d) of this 
section; except that delayed notice may be given pursuant to section 2705 of this title. 
(2) Paragraph (1) is applicable with respect to any wire or electronic communication that 
is held or maintained on that service - 

(A) on behalf of, and received by means of electronic transmission from (or 
created by means of computer processing of communications received by means of 
electronic transmission form), a subscriber or customer of such remote computing 
service; and 

(B) solely for the purpose of providing storage or computer processing services to 
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such subscriber or customer, if the provider is not authorized to access the contents of 

any such communications for purposes of providing any services other than storage or 

computer processing. 

(c) Records Concerning Electronic Communication Service or Remote Computing 
Service. - (1) A governmental entity may require a provider of electronic communication service 
or remote computing service to disclose a record or other information pertaining to a subscriber 
to or customer of such service (not including the contents of communications) only when the 
governmental entity - 

(A) obtains a warrant issued using the procedures described in the Federal Rules 
of Criminal Procedure by a court with jurisdiction over the offense under investigation or 
equivalent State warrant; 

(B) obtains a court order for such disclosure under subsection; 

(E) seeks information under paragraph (2). 

SEARCH PROCEDURE 

57. To ensure that agents search only the computer account and/or files contained 
therein and described in Attachment B, this search warrant seeks authorization to permit 
employees of Mail.com Corporation to assist agents in the execution of this warrant. To further 
ensure that agents executing this warrant search only the account and/or computer files described 
in Attachment B, the following procedures will be implemented: 

a) The warrant will be presented to Mail.com Corporation personnel who will be directed 

to isolate those accounts and files described in Attachment B. 
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b) To minimize any disruption of computer service to innocent third parties, Mail.com 
Corporation personnel will create an exact duplicate of all information stored in the 
computer account and/or files contained therein which are described in Attachment B. 

c) Mail.com Corporation personnel will provide the exact duplicate in hard copy an 
electronic form of the account and files described in Attachment B and all information 
stored in the account and/or files to the agent who serves this search warrant. Based on 
my training and experience, a voluminous amount of information can be stored in a 
computer account and law enforcement personnel must examine all the stored data to 
determine which files contain evidence, fruits, and instrumentalities of criminal activity. 
This sorting process is time consuming and would be impractical to do at the Mail.com 
Corporation's offices. Moreover, the sorting of information should be completed in a 
controlled environment because of the vast array of computer hardware and software that 
might be necessary to analyze the data as well as maintain its integrity. 

d) Law enforcement personnel will thereafter review the information stored in the 
accounts and files received from Mail.com Corporation and then separate and copy any 
messages, images, or information that constitutes evidence, fruits, or instrumentalities of 
criminal activity. 

e) Law enforcement personnel will then seal the original duplicate of the account and 
files received from Mail.com Corporation and will not further review the original 
duplicate absent an order of the Court; and 

f) Those files that contain evidence, fruits, or instrumentalities of violations of 18 U.S.C. 
§§ 2423(a), 2423(b), 2423(c), 2423(d), and 2251(d)(1)(A) will not be returned to the 
computers of Mail.com Corporation. 
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CONCLUSION 

58. Based on the aforementioned factual information, I respectfully submit that there 
is probable cause to believe that the e-mail accounts paradisepassion@email.com and 
offerparadise@yours.com located at Mail.com Corporation, 4957 Lakemont Boulevard, 
Bellevue, Washington 98006 have been used to promote and facilitate the transportation of 
minors in foreign commerce for sex, in violation of 18 U.S.C. §§ 2423(a), 2423(b), 2423(c), 
2423(d), and 2251(d)(1)(A). 

59. Further, there is probable cause to believe that evidence, fruits, and 
instrumentalities of such criminal offenses may be found in Mail.com Corporation's records. 

60. I, therefore, respectfully request that that attached warrant be issued authorizing 
the search and seizure of the items listed in Attachment B. 



Matthew K. Dunn 

Immigration & Customs Enforcement 



SUBSCRIBED and SWORN 

before me this of January 2006 



UNITED STATES MAGISTRATE JUDGE 
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ATTACHMENT A 
DESCRIPTION OF LOCATION TO BE SEARCHED 

The e-mail accounts paradisepassion@email.com and offerparadise@yours.com located at: 

Mail.com Corporation 
4957 Lakemont Boulevard 
Bellevue, Washington 98006 
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ATTACHMENT B 
DESCRIPTION OF ITEMS TO BE SEARCHED FOR AND SEIZED 

All subscriber and/or user information, the content of all opened and unopened electronic 
mail (e-mail), the content of all opened and unopened text messages, histories, buddy lists, 
profiles, method(s) of payment, detailed billing records, log files including connection dates and 
times, method(s) of connection (telenet, ftp, http, smtp), IP address(es) of the source of the 
connection, correspondence between Mail.com Corporation and the subscriber of the e-mail 
account including records of any customer service complaints, and images, including those of 
children and adults pertaining to e-mail addresses paradisepassion @ email.com and 
offerparadise@yours.com . 



